Trace the service
Start with a real use case and map inputs, processing, models, tools, data, outputs and human approvals.
GUIDE / PROTOCOL
Map AI system dependencies
An AI service is more than its model: continuity also depends on data, interfaces, people and contracts.
Direct answer
How should an AI dependency be assessed?
Describe the chain that delivers the service, assign an owner to each component and simulate failure or replacement. A risk becomes actionable when its effect, detection time and fallback are explicit.
01 / Review method
Review method
Qualify dependencies
Record vendor, exchanged data, contractual jurisdiction, cost, quota, version, substitutability and internal owner.
Test disruptions
Simulate outage, price change, answer degradation, API withdrawal or failed export.
Choose a fallback
Define alert thresholds, degraded mode, backups, export, tested migration and an authorized stop decision.
02 / Evidence to keep
Evidence to keep
Flow map
Dated diagram of components, data boundaries and human interventions.
Vendor register
Contracts, versions, quotas, costs and exit conditions verified at audit time.
Replacement trial
Export and substitute test results, including quality and cost differences.
Continuity plan
Thresholds, owners, manual or alternative mode and acceptable recovery time.
AFTER THE REVIEW
Decide from the evidence
One vendor holds both data and execution
Identify what cannot be exported or replaced. Prepare usable copies, degraded operation and a substitution trial before rating the risk.
A dependency has no owner
Name an owner, alert threshold and fallback action. A map without decision or test does not prove an exit capability.
03 / FAQ
Frequently asked questions
Must everything be self-hosted?
No. Decide from the data, required control, skills, cost and ability to exit.
What makes a dependency critical?
Failure or change blocks an essential outcome with no acceptable fallback.
How can reversibility be tested?
Export data and configuration, rebuild a minimum journey elsewhere and measure the gaps.
Who owns the register?
Business and technical owners should both be able to read, update and act on it.
04 / Official references